datadunia
58 lines
3.1 KiB
Markdown
58 lines
3.1 KiB
Markdown
# NexusGuard SD-WAN Suite
|
|
|
|
NexusGuard is an Enterprise Zero-Trust SD-WAN solution built with Go, Vue 3, and WireGuard. It enables stealth VPN tunneling, centralized IPAM, and real-time network isolation via `nftables`.
|
|
|
|
## 🏗️ System Architecture
|
|
This suite contains three main components:
|
|
1. **[Server Core](http://git.datadunia.com/nexusguard/nexus-server-core)**: The central API and VPN Hub managing database state, token distribution, and Linux firewall isolation.
|
|
2. **[Dashboard UI](http://git.datadunia.com/nexusguard/nexus-dashboard-ui)**: The Admin Web GUI for managing Nodes, Users, Devices, and Firewall rules.
|
|
3. **[Device Agent](http://git.datadunia.com/nexusguard/nexus-device-agent)**: A stealth background daemon for Linux client machines that establishes memory-injected WireGuard tunnels.
|
|
|
|
---
|
|
|
|
## 🚀 Deployment & Installation
|
|
|
|
### 1. Initial Setup
|
|
To deploy the entire backend infrastructure (PostgreSQL, Redis, and Server-Core), simply clone this repository and run the setup script:
|
|
|
|
```bash
|
|
git clone https://git.datadunia.com/nexusguard/Nexus-Guard-Suite.git
|
|
cd Nexus-Guard-Suite
|
|
chmod +x setup.sh
|
|
./setup.sh
|
|
```
|
|
|
|
The `setup.sh` script will automatically:
|
|
- Create a master `.env` file (if it doesn't exist).
|
|
- Boot up all required infrastructure via `docker-compose`.
|
|
|
|
### 2. Domain & Port Configuration
|
|
If you are deploying this to production, you must edit the `.env` file generated in the root directory:
|
|
- **Change API Port**: Modify `API_PORT=8080`.
|
|
- **Change Web/API Domain**: Modify `VITE_API_BASE_URL` to point to your public API domain (e.g., `https://api.yourdomain.com/api/v1`).
|
|
- **Database & Crypto**: Ensure you change the default database passwords and generate secure 256-bit Hex keys for `JWT_SECRET` and `SERVER_SALT`.
|
|
|
|
### 3. Creating / Changing the Admin Account
|
|
The system operates on a strict **Zero-Attack Surface** policy. The `/auth/register` API is locked down. To create the first Admin user (or reset their password), you must execute a command directly inside the running Docker container:
|
|
|
|
```bash
|
|
docker exec -it nexus-guard-suite-server-core-1 ./server-core -create-admin -user "admin" -pass "YourNewSecurePassword123!"
|
|
```
|
|
*(You can use this exact same command later if you ever forget the admin password to forcefully reset it).*
|
|
|
|
---
|
|
|
|
## 📖 Operational Workflow
|
|
|
|
Once the server is running and the Admin account is created, follow this flow:
|
|
|
|
1. **Log in to the Dashboard UI** using the `admin` credentials.
|
|
2. **Register a WireGuard Node**: Go to the **Nodes** menu. Add your public WireGuard server endpoint (e.g., `vpn.yourdomain.com:51820`) and its Public Key.
|
|
3. **Add a Device**: Go to the **Devices** menu. Click **+ New Device**, select the target Node, and name the device.
|
|
4. **Copy the Token**: The system will display a single-use **Registration Token**.
|
|
5. **Install the Agent on Client**: On the target Linux machine, run the agent installer:
|
|
```bash
|
|
sudo ./install_agent.sh --server-url "https://api.yourdomain.com" --token "<REG_TOKEN>"
|
|
```
|
|
6. The client will automatically connect, provision its WireGuard keys securely via AES-256-GCM, and appear as **Online** on your Dashboard.
|